kodeco 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 917b9f6e09b0d724f94ff27f1596cba5c870545dc6a1199a0ebb31cd7a68d114
-  data.tar.gz: c9e3e16f779d27b3353e42593cb37abf181f9e3d1459b60dc79cef5d1b20d48d
+  metadata.gz: 21e401351ab9adc6500a6f950ae55044bb443ca6de317ca57acf8bc25f89bbbd
+  data.tar.gz: b5ba461481bfa7a3023027cf780d0a58f1e570013364e433bbf3ffbf9fba7cad
 SHA512:
-  metadata.gz: a5812db82c6f20d0bb3346fd4dd501149a58f382235038b6b274b78e7bae1329cdad77791469d0f83743ac6ad55022037c06eb363ec7a4c8f0bb3b8bf01d3ed3
-  data.tar.gz: 105c668ab4fc503d874401e048f6cec51e5732e7df7673f91e9cf2c6e43992486fa065310b1e842213ab45b642f8a311a60cc9f7f54be25d9c8d07a27c1dfc7d
+  metadata.gz: e2f70ef215eec74514d602c5d4de7fb1ef8f8fa15a7bbbafc5243b38ad07a7abeb4fecd7752885068e84776d850551a6b89876d7878405be05432e96443f657f
+  data.tar.gz: a6439d86cf76759ea24c873f9eb2c09a0c3b18a7ed38cba3035b2066f532734556eacc36946bf7b97f48cd51d73b9a37cfaf5f02114d60d13871f1da255ba93a

data/README.md

@@ -52,8 +52,9 @@ admin. A login gets whichever of the requested scopes you hold, and `login`
 lists any that weren't granted; a grant added later needs a fresh
 `kodeco login`.
 
-`logout` deletes the local credentials. guardpost has no revoke endpoint, so
-the server session lasts up to 7 days unless an admin revokes it.
+`logout` signs the session out on guardpost, then deletes the local
+credentials. If guardpost can't be reached, it still deletes them and says
+so; the session then ends within 7 days, or an admin can sign it out.
 
 Every command takes:
 

data/lib/periscope/cli.rb

@@ -10,13 +10,14 @@ module Periscope
     include Commands::Kerching
     include Commands::Flags
     include Commands::Shortlinks
+    include Commands::Logout
 
     USAGE = <<~TEXT
       Usage: kodeco <command> [options]
 
       Commands:
         login [--scopes "a b"] [--no-browser]  Log in with guardpost's device-code flow
-        logout                                 Delete the local credentials
+        logout                                 Sign out on guardpost and delete the local credentials
         whoami [--app guardpost|kerching|carolus]
                                                Show who an app takes you to be
         user <email|rwuuid>                    Show guardpost's customer summary
@@ -37,8 +38,6 @@ module Periscope
     TEXT
 
     COMMANDS = %w[login logout whoami user orders order subscription problems flags shortlinks].freeze
-    LOGOUT_NOTE = "guardpost has no revoke endpoint, so the server session lasts up to 7 days " \
-                  "unless an admin revokes it."
 
     def initialize(argv, env: ENV, stdout: $stdout, stderr: $stderr, login_options: {})
       @argv = argv.dup
@@ -96,14 +95,6 @@ module Periscope
         "then run kodeco login again."
     end
 
-    def cmd_logout
-      parse_options
-      deleted = store.with_lock { store.delete }
-      emit({ "logged_out" => true, "had_credentials" => !deleted.nil?, "note" => LOGOUT_NOTE }) do
-        deleted ? "Logged out locally. #{LOGOUT_NOTE}" : "Not logged in; there was nothing to delete."
-      end
-    end
-
     def cmd_whoami
       opts = parse_options { |parser, o| parser.on("--app APP", Config::APPS) { |v| o[:app] = v } }
       data = client.get(opts[:app] || "guardpost", "/api/v2/whoami")["data"] || {}

data/lib/periscope/commands/logout.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module Periscope
+  module Commands
+    # kodeco logout
+    module Logout
+      REVOKE_PATH = "/api/v2/auth/revoke"
+
+      private
+
+      def cmd_logout
+        parse_options
+        revoked = false
+        reason = nil
+        deleted = store.with_lock do
+          refresh_token = store.read&.dig("refresh_token")
+          revoked, reason = revoke(refresh_token) if refresh_token
+          store.delete
+        end
+        emit({ "logged_out" => true, "had_credentials" => !deleted.nil?, "revoked" => revoked }) do
+          logout_text(deleted, revoked, reason)
+        end
+      end
+
+      # Returns [revoked, reason]. It doesn't raise for guardpost's answer or a
+      # network error, so the local credentials are deleted whatever happens.
+      def revoke(refresh_token)
+        res = http.post_form("#{config.url('guardpost')}#{REVOKE_PATH}",
+                             token: refresh_token, token_type_hint: "refresh_token")
+        return [true, nil] if res.status == 200
+
+        [false, "guardpost answered #{res.status}#{": #{res.error_message}" if res.error_message}"]
+      rescue Error => e
+        [false, e.message]
+      end
+
+      def logout_text(deleted, revoked, reason)
+        return "Not logged in; there was nothing to delete." unless deleted
+        return "Logged out, and signed out on guardpost." if revoked
+        return "Logged out locally. There was no refresh token to sign out on guardpost with." unless reason
+
+        "Logged out locally, but couldn't reach guardpost to end the session (#{reason}).\n" \
+          "The session ends within 7 days, or an admin can sign it out."
+      end
+    end
+  end
+end

data/lib/periscope/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Periscope
-  VERSION = "0.2.0"
+  VERSION = "0.3.0"
 end

data/lib/periscope.rb

@@ -16,4 +16,5 @@ require_relative "periscope/commands/user"
 require_relative "periscope/commands/kerching"
 require_relative "periscope/commands/flags"
 require_relative "periscope/commands/shortlinks"
+require_relative "periscope/commands/logout"
 require_relative "periscope/cli"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kodeco
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Kodeco
@@ -22,6 +22,7 @@ files:
 - lib/periscope/client.rb
 - lib/periscope/commands/flags.rb
 - lib/periscope/commands/kerching.rb
+- lib/periscope/commands/logout.rb
 - lib/periscope/commands/shortlinks.rb
 - lib/periscope/commands/user.rb
 - lib/periscope/config.rb